Issue: The user performs one of the following actions:

In the above scenarios, the Filepath and CommandLine fields in the Monitoring Exclude threat sections aren't populated and are empty.

Issue: When you use the MVISION EDR API, you see that the API events exceed the defined event limits. Although the Case Management runbook supplied with the APIs mentions limits, it doesn't clearly state how to set limits in actual numbers.

The API for rate limiting is
/case-mgmt/v1/rate-limits (GET, PUT)

Rate limits can be applied to the actions below:

 The default rate-limits are as below:
rate-limits 
{// Rate Limits default values.  // Use API to change rate limits. // new case by tenant
new-case = [ { max = 10 duration = "1 hour"} { max = 20  duration = "1 day"} ]
 // new evidence by case by tenant
new-evidence-to-case = [{max = 10  duration = "1 hour"} ]
// new evidence by tenant
new-evidence = [{max = 10   duration = "1 hour"} ] }

Issue: When you run Historical search queries that contain more than three days of information and use include or exclude filters, you see the error below:
 

Solution: Narrow your query. Include less than three days of information or remove the include or exclude filters.

Issue: MVISION EDR can't connect to the configured DXL broker. If you look in the DXL broker IPE log, you see the error below:

Below minimum threshold.

Cause: There are two possible causes:

 Solution:

Issue: Can't end Quarantine in an endpoint that's using a VPN
 
Solution:

Issue: An EDR Reaction fails to execute in the endpoint.
 
Cause: An option in ENS prevents EDR from running some Real-Time Search Reactions.
 
Workaround: Add an exclusion to the EDR service in the ENS Exploit Prevention policy:

Issue: On Windows 10 build 1607 (RS1), applications such as Microsoft Office, Adobe Acrobat Reader, and Chrome, fail to start.
 
Workaround 1:
Install all Windows updates for build 1607 (RS1).
 
Workaround 2:

NOTE: By disabling this option, the EDR client doesn't detect when a process injects another process.

Issue: When you quarantine an endpoint connected to a VPN, the endpoint becomes unreachable.
You can't send the reaction to End the Quarantine.
 
Workaround:

Issue: Can't install MVISION EDR client with ENS 10.6.2/6.3 in Linux because of failed dependencies:
You see the error below:
 

Solution: Upgrade to ENS 10.6.4 or later.

Issue: When you disable telemetry feedback options, the feedback option requires that you accept the sharing of telemetry data. If you don't accept it, the send button on the feedback section isn't enabled.

Solution: Enable telemetry settings: